Amazon Linux 2 (EOS) Security Advisory: ALAS2ECS-2026-137
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
FAQs regarding Amazon Linux ALAS/CVE Severity
An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during the selection of a connection pool. This null pointer dereference is a CWE-476 flaw that may cause the process to crash or terminate unexpectedly, leading to a denial of service for the services routed through the affected Envoy instance. The vulnerability is triggered when a client initiates an HTTP/3 session that exercises the connection-pool selection logic, which may provide the attacker a remote execution path to disrupt the proxy. (CVE-2026-48521)
Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. (CVE-2026-50572)
Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. (CVE-2026-73511)
Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. (CVE-2026-73512)
Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process. (CVE-2026-73513)
Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content. (CVE-2026-73546)
Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header. (CVE-2026-73547)
Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. (CVE-2026-73548)
Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. (CVE-2026-73549)
Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. (CVE-2026-73550)
Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. (CVE-2026-73551)
Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. (CVE-2026-73552)
Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route. (CVE-2026-73553)
Affected Packages:
ecs-service-connect-agent
Note:
This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update ecs-service-connect-agent or yum update --advisory ALAS2ECS-2026-137 to update your system.
aarch64:
ecs-service-connect-agent-v1.39.1.0-1.amzn2.aarch64
src:
ecs-service-connect-agent-v1.39.1.0-1.amzn2.src
x86_64:
ecs-service-connect-agent-v1.39.1.0-1.amzn2.x86_64